Option GuardPrivacy policy
This policy covers the Option Guard app: what it stores when a merchant installs it on a Shopify store, why it needs each piece, and how long it keeps it. Every item named below has a table or an API call behind it.
Who we are
Option Guard is operated by Apitide. Write to kontakt@apitide.dev with anything on this page.
What the app stores
Shop credentials. The offline access token Shopify issues at install, the shop domain, the granted scopes and the token expiry. Without these the app cannot talk to the store's Admin API.
Option configuration. The fields a merchant defines: labels, keys, whether a field is required, and the choices for a dropdown. All of it is stored in Shopify, in an app-owned product metafield, so it sits on the merchant's own store instead of our servers.
Order integrity alerts. When an order arrives whose line items are missing an option the merchant marked required, the app records the shop domain, the order id and order name (for example #1042), the line item id, the product id, and the labels of the missing options.
What the app does not store
No customer names. No email addresses, phone numbers, shipping or billing addresses, or payment details. The app also does not store the values a customer types into an option field. An alert records what was missing, never what was entered.
The app requests read_orders access because an order's line item properties are the only place it can confirm that a customer's choices reached the order. The webhook payload is read in memory and discarded. Only the fields listed above are written down.
Storefront behaviour
Option fields are rendered by a Shopify theme app extension whose script is served from Shopify's CDN. When a customer views a product or adds it to the cart, the storefront makes no request to our servers. The app sets no cookies there and runs no analytics or tracking.
How long data is kept
Order integrity alerts are deleted 90 days after they are recorded, and immediately when a merchant dismisses one. Shop credentials are deleted at uninstall, or when Shopify sends a shop redaction request. Uninstalling the app removes everything it holds about a store.
Shopify's mandatory privacy webhooks
customers/data_request: the app holds no customer personal data, so there is nothing to return. The request is acknowledged and logged.customers/redact: nothing to erase, for the same reason.shop/redact: the shop's alert records and stored credentials are deleted.
Where data is stored, and security
Data is stored in Cloudflare D1 in the EU region, encrypted at rest by the platform and in transit over TLS. Access to the production environment is limited to the operator.
Sub-processors
- Shopify: the platform the app runs on. It hosts the option configuration and provides the Admin API.
- Cloudflare: hosting and database.
Nothing is sold or shared with anyone else, and none of it trains a machine learning model.
Your choices
Dismissing an alert deletes it straight away, and uninstalling the app deletes everything left for that store. Questions and data requests go to kontakt@apitide.dev.
Changes
If this policy changes materially, the new version is published at this address and the date above changes with it.